Procedure examples

APT38 leveraged Sysmon to understand the processes, services in the organization.

APT3 has a tool that can list out currently running processes.

Kimsuky can gather a list of all processes running on a victim's machine. Kimsuky has also obtained running processes on the victim device utilizing PowerShell cmdlet `Get-Process`.

Volt Typhoon has enumerated running processes on targeted systems including through the use of Tasklist.

HAFNIUM has used `tasklist` to enumerate processes.

MuddyWater has used malware to obtain a list of running processes on the system.

Gamaredon Group has used tools to enumerate processes on target hosts including Process Explorer.

TeamTNT has searched for rival malware and removes it if found. TeamTNT has also searched for running processes containing the strings aliyun or liyun to identify machines running Alibaba Cloud Security tools.

FIN7 has used the PowerShell script 3CF9.ps1 to perform process discovery by executing `tasklist /v`. Additionally, WsTaskLoad.exe executes `tasklist /v` to perform process discovery.

Andariel has used tasklist to enumerate processes and find a specific string.

Sidewinder has used tools to identify running processes on the victim's machine.

Mustang Panda has used tasklist /v to determine active process information. Mustang Panda has also used TONESHELL malware to check the process name and process path to ensure it matches the expected one prior to triggering a custom exception handler.

Rocke can detect a running process's PID on the infected machine.

UNC3886 has run scripts to list all running processes on a guest VM from an ESXi host.

APT37's Freenki malware lists running processes using the Microsoft Windows API.

OilRig has run tasklist on a victim's machine and used infostealers to capture processes.

Higaisa’s shellcode attempted to find the process ID of the current process.

Tropic Trooper is capable of enumerating the running processes on the system using pslist.

Ke3chang performs process discovery using tasklist commands.

APT1 gathered a list of running processes on the system using tasklist /v.

Turla surveys a system upon check-in to discover running processes using the tasklist /v command. Turla RPC backdoors have also enumerated processes associated with specific open ports or named pipes.

Storm-0501 has discovered running processes through `tasklist.exe`.

After compromising a victim, Poseidon Group lists all running processes.

Stealth Falcon malware gathers a list of running processes.

Chimera has used tasklist to enumerate processes.

MirrorFace has used Tasklist on compromised hosts for discovery.

Medusa Group has utilized a hard-coded security tool process list that identifies and terminates using an undocumented IOCTL code 0x222094.

Darkhotel malware can collect a list of running processes on a system.

Deep Panda uses the Microsoft Tasklist utility to list processes running on systems.

Windshift has used malware to enumerate active processes.

ToddyCat has run `cmd /c start /b tasklist` to enumerate processes.

An APT28 loader Trojan will enumerate the victim's processes searching for explorer.exe if its current process does not have necessary permissions.

APT5 has used Windows-based utilities to carry out tasks including tasklist.exe.

Winnti Group looked for a specific process running on infected servers.

Several Lazarus Group malware families gather a list of running processes on a victim system and send it to their C2 server. A Destover-like variant used by Lazarus Group also gathers process times.

Earth Lusca has used Tasklist to obtain information from a compromised host.

Molerats actors obtained a list of active processes on the victim and sent them to C2 servers.

Inception has used a reconnaissance module to identify active processes and other associated loaded modules.

Play has used the information stealer Grixba to check for a list of security processes.

HEXANE has enumerated processes on targeted systems.

Magic Hound malware can list running processes.